ZeroDay Findings
Sign inSign up

Findings

CVE-2026-3138

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check in all versions up to, and inc…

Published Mar 24, 2026 · updated Jun 17, 2026

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check in all versions up to, and including, 3.1.2. This is due to the plugin's MVC framework dynamically registering unauthenticated AJAX handlers via hooks without verifying user capabilities, combined with the base controller's magic method forwarding undefined method calls to the model layer, and the method defaulting to when no permissions are explicitly defined. This makes it possible for unauthenticated attackers to truncate the plugin's database table via a crafted AJAX request with , permanently destroying all filter configurations.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 24, 2026 · NIST NVD

    Detected

    The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check in all versions up to, and including, 3.1.2. This is due to the plugin's MVC framework dynamically registering unauthenticated AJAX handlers via hooks without verifying user capabilities, combined with the base controller's magic method forwarding undefined metho

  2. Jun 17, 2026 · NIST NVD

    Updated

    The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check in all versions up to, and including, 3.1.2. This is due to the plugin's MVC framework dynamically registering unauthenticated AJAX handlers via hooks without verifying user capabilities, combined with the base controller's magic method forwarding undefined metho

Sources

  • CVE.orgVulnerability recordCVE-2026-3138

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-3138

    The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check in all versions up to, and including, 3.1.2. This is due to the plugin's MVC framework dynamically registering unauthenticated AJAX handlers vi

    nvd.nist.gov

References